# Namespace
apiVersion: v1
kind: Namespace
metadata:
  name: gpustack-system-{{ config.cluster_suffix }}
---
# Secret
apiVersion: v1
kind: Secret
metadata:
  name: registration-token
  namespace: gpustack-system-{{ config.cluster_suffix }}
type: Opaque
data:
  token: {{ config.token | b64encode }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ingressclass-viewer
rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingressclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ingressclass-viewer-binding
subjects:
  - kind: ServiceAccount
    name: gpustack-worker
    namespace: gpustack-system-{{ config.cluster_suffix }}
roleRef:
  kind: ClusterRole
  name: ingressclass-viewer
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-cm-creator
rules:
  - apiGroups:
      - ""
    resources:
      - "pods"
      - "configmaps"
      - "services"
      - "pods/log"
      - "pods/exec"
    verbs:
      - "*"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: gpustack-system-{{ config.cluster_suffix }}
  name: gpustack-worker
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: gpustack-system-{{ config.cluster_suffix }}
  name: pod-cm-creator
subjects:
- kind: ServiceAccount
  name: gpustack-worker
  namespace: gpustack-system-{{ config.cluster_suffix }}
roleRef:
  kind: ClusterRole
  name: pod-cm-creator
  apiGroup: rbac.authorization.k8s.io
---
# Service
apiVersion: v1
kind: Service
metadata:
  name: worker
  namespace: gpustack-system-{{ config.cluster_suffix }}
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "10151"
    prometheus.io/path: "/metrics"
spec:
  type: ClusterIP
  selector:
    app: gpustack-worker
  ports:
    - name: gateway
      port: 8080
      targetPort: 8080
    - name: api
      port: 10150
      targetPort: 10150
    - name: metrics
      port: 10151
      targetPort: 10151
---
# DaemonSet
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: gpustack-worker
  name: gpustack-worker
  namespace: gpustack-system-{{ config.cluster_suffix }}
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: gpustack-worker
  template:
    metadata:
      labels:
        app: gpustack-worker
    spec:
      containers:
        - env:
            - name: GPUSTACK_TOKEN
              valueFrom:
                secretKeyRef:
                  key: token
                  name: registration-token
            - name: GPUSTACK_SERVER_URL
              value: {{ config.server_url }}
            - name: GPUSTACK_PORT
              value: '8080'
            - name: GPUSTACK_WORKER_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: GPUSTACK_RUNTIME_DEPLOY
              value: "Kubernetes"
            - name: GPUSTACK_RUNTIME_DEPLOY_MIRRORED_DEPLOYMENT
              value: "true"
            - name: GPUSTACK_RUNTIME_DEPLOY_MIRRORED_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: GPUSTACK_RUNTIME_KUBERNETES_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: GPUSTACK_RUNTIME_KUBERNETES_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          image: {{ config.image }}
          imagePullPolicy: IfNotPresent
          name: gpustack-worker
          resources: {}
          securityContext:
            allowPrivilegeEscalation: true
            capabilities: {}
            privileged: true
            readOnlyRootFilesystem: false
            runAsNonRoot: false
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - name: gpustack-data-dir
              mountPath: /var/lib/gpustack
            #
            # (Optional) Mount Ascend driver and toolkit directories if using Ascend devices
            #
            - name: gpustack-ascend-driver
              mountPath: /usr/local/Ascend/driver
            - name: gpustack-ascend-toolkit
              mountPath: /usr/local/Ascend/ascend-toolkit
          ports:
            - name: gateway
              containerPort: 8080
              protocol: TCP
            - name: api
              containerPort: 10150
              protocol: TCP
            - name: metrics
              containerPort: 10151
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /readyz
              port: api
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
            successThreshold: 1
          livenessProbe:
            httpGet:
              path: /healthz
              port: api
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 5
            successThreshold: 1
      volumes:
        - name: gpustack-data-dir
          hostPath:
            path: /var/lib/gpustack
            type: DirectoryOrCreate
        #
        # (Optional) Mount Ascend driver and toolkit directories if using Ascend devices
        #
        - name: gpustack-ascend-driver
          hostPath:
            path: /usr/local/Ascend/driver
            type: DirectoryOrCreate
        - name: gpustack-ascend-toolkit
          hostPath:
            path: /usr/local/Ascend/ascend-toolkit
            type: DirectoryOrCreate
      hostNetwork: true
      hostIPC: true
      serviceAccountName: gpustack-worker
  updateStrategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
